Bug 249058 – Fix use-after-move in WebCore:: LineBuilder::tryPlacingFloatBox()

• Status: RESOLVED
• Resolution: FIXED
• Component: Layout and Rendering

[David Kilzer (:ddkilzer)]

Fix use-after-move in WebCore::LineBuilder::tryPlacingFloatBox() in Source/WebCore/layout/formattingContexts/inline/InlineLineBuilder.cpp.

The `floatBoxItem` variable is involved in the use-after-move below.

```
bool LineBuilder::tryPlacingFloatBox(const InlineItem& floatItem, LineBoxConstraintApplies lineBoxConstraintApplies)
{
    [...]
    auto floatBoxItem = floatingContext.toFloatItem(floatBox);
    auto isLogicalLeftPositionedInFloatingState = floatBoxItem.isLeftPositioned();
    floatingState()->append(WTFMove(floatBoxItem));  // Move.
    [...]
    // FIXME: In quirks mode some content may sneak above this float.
    if (shouldAdjustLineLogicalLeft()) {
        auto floatLogicalRight = InlineLayoutUnit { floatBoxItem.rectWithMargin().right() };  // Use-after-move.
        [...]
    }
    [...]
}
```

Not sure what the default move constructor for `WebCore::FloatingState::FloatItem` will do to the moved-from object, but this should be avoided if possible.

[zalan]

(In reply to David Kilzer (:ddkilzer) from comment #0)
> Fix use-after-move in WebCore::LineBuilder::tryPlacingFloatBox() in
> Source/WebCore/layout/formattingContexts/inline/InlineLineBuilder.cpp.
> 
> The `floatBoxItem` variable is involved in the use-after-move below.
> 
> ```
> bool LineBuilder::tryPlacingFloatBox(const InlineItem& floatItem,
> LineBoxConstraintApplies lineBoxConstraintApplies)
> {
>     [...]
>     auto floatBoxItem = floatingContext.toFloatItem(floatBox);
>     auto isLogicalLeftPositionedInFloatingState =
> floatBoxItem.isLeftPositioned();
>     floatingState()->append(WTFMove(floatBoxItem));  // Move.
>     [...]
>     // FIXME: In quirks mode some content may sneak above this float.
>     if (shouldAdjustLineLogicalLeft()) {
>         auto floatLogicalRight = InlineLayoutUnit {
> floatBoxItem.rectWithMargin().right() };  // Use-after-move.
>         [...]
>     }
>     [...]
> }
> ```
> 
> Not sure what the default move constructor for
> `WebCore::FloatingState::FloatItem` will do to the moved-from object, but
> this should be avoided if possible.
Yeah, good catch. Fortunately it's safe, nothing gets moved here. -will nevertheless.

[zalan]

"-will nevertheless." should read "will fix nevertheless"

[zalan]

Created attachment 463977 [details]
[fast-cq]Patch

[EWS]

Committed 257688@main (59efc6d73de9): <https://commits.webkit.org/257688@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 463977 [details].

[Radar WebKit Bug Importer]

<rdar://problem/103218248>